GitHub Desktop 3.6.10 Introduces Short-Lived Authentication Tokens
GitHub Desktop version 3.6.10 and later now supports automatic renewal of short-lived authentication tokens to improve security for GitHub accounts.
GitHub Desktop 3.6.10 and later now supports signing in eligible accounts using short-lived authentication tokens that refresh automatically. GitHub announced this update on November 2, 2026, to reduce the time window where a leaked token remains usable.
During normal work, Desktop handles renewal independently for both GitHub API requests and Git operations, meaning you do not have to manage renewals yourself. Because these credentials replace long-lived ones, any stolen token stays valid for a significantly shorter duration.
The gradual rollout covers github.com and GitHub Enterprise Cloud, though not every account has immediate access, and GitHub Enterprise Server is excluded from this phase. Upgrading your client will not sign you out, current sessions keep working, and existing tokens are not migrated automatically. Instead, short-lived tokens are issued upon sign-in once the rollout reaches your installation.
To become eligible, you must be on the latest version of GitHub Desktop. You can find sign-in instructions in the official authentication documentation, and you can submit problem reports or feedback directly to the GitHub Desktop repository or GitHub Support.